[Cfrg] misuse resistant crypto (was: Re: Fwd: Draft NIST Special Publication 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping)

Hi Dan,

On Aug 15, 2011, at 10:05 AM, Dan Harkins wrote:

>
>  Hi David,
>
> On Mon, August 15, 2011 9:30 am, David McGrew wrote:
>> FYI - NIST is requesting feedback on the draft specification for Key
>> Wrapping.  This will probably be of interest to implementers of RFCs
>> 3394 and 5649.
>
>  ...and RFC 5297 too!
>
>> Comments on the draft should be sent directly to NIST, of course.
>> Discussion about the use of key wrapping in Internet standards is
>> welcome on the CFRG list.
>
>  SIV is being used in the just-ratified 802.11s amendment for "mesh
> networking" to do key wrapping. The reason it was chosen is its  
> ability
> to bind additional data to the wrapped key-- the message itself is
> authenticated and bound to the key such that the key cannot be  
> unwrapped
> if the message it is being sent in has been tampered with.
>
>  I hate to sound like a broken record but SIV really is a swiss army
> knife for crypto protocol design. It slices, it dices, it's a misuse
> resistant AEAD scheme, it wraps arbitrary-length keys (no padding  
> req'd)
> and binds additional data to the wrapped key. And it's provably  
> secure.
>
>  Dan.

I was recently having an email conversation with Tom Shrimpton on the  
same subject.  I think it would make sense to analyze and document the  
need for misuse-resistant crypto, by reviewing failure modes, problem  
areas, and whatever actual case studies of misuse we can come up  
with.  (It sounds like Peter G. has several that we could use.)

I think it would be a useful approach to consider the need for misuse- 
resistant crypto in a way that is independent from a particular  
algorithm proposal, because it might convince more peole of the  
importance of the issue if we can document the need and the  
requirements.   This exercise might also uncover failure modes that we  
haven't yet anticipated, or it might help us understand which failure  
modes are the most common or the most damaging.  What do you think -  
does that sound like something worth doing?

David

>
>> David
>>
>> Begin forwarded message:
>>
>>> From: NIST Computer Security Resource Center
>>> <csrc.nist@service.govdelivery.com
>>>>
>>> Date: August 15, 2011 8:37:36 AM PDT
>>> To: nist-interest@cisco.com
>>> Subject: Draft NIST Special Publication 800-38F, Recommendation for
>>> Block Cipher Modes of Operation: Methods for Key Wrapping
>>> Reply-To: NIST Computer Security Resource Center
>>> <csrc.nist@service.govdelivery.com
>>>>
>>>
>>> Draft Special Publication 800-38F
>>>
>>> NIST is pleased to announce that the Draft NIST Special Publication
>>> 800-38F, Recommendation for Block Cipher Modes of Operation: Methods
>>> for Key Wrapping, is available for public comment.
>>>
>>> For more informaiton regarding this draft please visit the CSRC
>>> Drafts page at:
>>> http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-38-F
>>>
>>>
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> http://www.irtf.org/mailman/listinfo/cfrg
>>
>
>